Cursor EUVD-2026-39536

Exploitation requires Cursor prior to 3.0 running its default agent terminal sandbox, and requires the AI agent to be influenced to act maliciously (e.g., via prompt injection in repository/content the agent processes) - the description's 'malicious agent' is the core prerequisite. The attacker must get the agent to (1) create an in-workspace symlink whose target is outside the workspace, and (2) force path canonicalization to fail, achievable by pointing the symlink at a non-existent target or by removing read permission from the path. Limiting factors: the victim must be using the agent feature (the sandbox only governs agent-run commands), the attack needs an avenue to steer the agent (so an isolated agent working only on fully trusted local code is not exposed), and impact runs under the invoking user's OS privileges, not root. No additional human approval is needed because the bug specifically bypasses the approval gate - only a 'benign prompt' from the user is involved.

Signals are largely consistent on high severity: the vendor CVSS 4.0 base score is 9.3 with vector AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity, and availability impact, reflecting a reliable, low-complexity bypass that needs no special attack requirements. The realistic risk hinges on one precondition the raw vector understates - exploitation requires a 'malicious agent,' i.e. the attacker must influence what Cursor's AI agent does, plausibly via prompt injection embedded in repository content, documentation, or external data the agent ingests; the description notes 'no user interaction beyond a benign prompt,' so a developer simply using the agent on attacker-influenced content is enough. No EPSS score, KEV listing, or POC is present in the provided data, so there is no current evidence of in-the-wild or automated exploitation; the threat is presently theoretical-but-credible rather than confirmed active. Note a tension to verify: the CVSS marks AV:N, but the write primitive itself is local to the host running Cursor - the 'network' vector is justified only through remote delivery of malicious agent input, not direct remote interaction with a listening service. Treat this as a high-priority patch for any environment running Cursor with the default agent sandbox, especially where agents process untrusted repositories.

A developer asks Cursor's agent to work on a repository that contains attacker-planted prompt-injection content; acting on it, the agent creates an in-workspace symlink pointing outside the workspace and ensures canonicalization fails (target absent or read permission removed). The agent then issues a Write through the symlink - bypassing approval - to overwrite the cursorsandbox helper, so the next agent terminal command executes unsandboxed on the host under the user's privileges. No public exploit code is identified at this time, but the low complexity (AC:L) and lack of required user interaction make the technique highly reliable once an agent is influenced.